> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/privileged-access-pam-setup/setting-up-privileged-access-end-to-end.md).

# Setting up privileged access end to end

This is the ordered path from an unmanaged server to a recorded privileged session. Five steps, each linking to the reference page that covers it in full.

By the end, a named user will be able to reach a server through SECUREpass without ever holding its password, and you will be able to watch the recording afterwards.

{% stepper %}
{% step %}

## Onboard the resource

Open **Manage Resources → Manage Systems** for a server, or **Manage Databases** for a database instance. Both follow the same four-step wizard.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/vdEFlx0LeleLoDnip6OI/assets/01.png)

Select **Add System** and complete step 1 — system type, address, protocol and port, then the PAM security policy that governs what a session on this resource may do.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/LCvGQWgGEtMh7V6fAS9T/assets/02.png)

Use **Test Connection** before going further. A failure here is almost always a firewall rule or a gateway address that has not been whitelisted.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/xN28F6gtQi9VPo2clWnt/assets/03.png)

In step 2, fetch the local accounts, test the credentials, and add the account you want under management.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/fbX5GHcjimXj4A5Kdv7Z/assets/04.png)

Step 3 derives roles from the account's group memberships. Step 4 sets how users authenticate before a session can start.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/jcv2NtlNbn8Pn8YkWlm7/assets/05.png)

Select **Save**.

> Full detail: *Privileged Access → Connecting target systems*.
> {% endstep %}

{% step %}

## Check the vault and rotation

Onboarding the account puts its credential in the vault. Open the Account Vault from the padlock icon on the Manage Systems row and confirm the rotation policy is what you want — local accounts default to 90 days.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/XAiCLjiovXQG6e3XdJcn/assets/06.png)

> Full detail: *Privileged Access → Privileged account vault*.
> {% endstep %}

{% step %}

## Map users to the resource

Onboarding a system gives nobody access to it. Access is granted separately.

Open **Access Management → Access Control**, select the **Systems** tab, then **Add Mapping**.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/k10UtNu9nJeObhsB8XB4/assets/07.png)

Select the users, then set the mapping details — the resource, the privileged account they will sign in as, whether dual control applies, and the validity window.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/84686pqvDNuc7nthCtbn/assets/08.png)

Select **Create**.

> Full detail: *Access Management → System access control*.
> {% endstep %}

{% step %}

## Connect from the Self Service Portal

The user now sees the system in the portal. On the dashboard, open the **Systems** tab under **My Resources**.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/TY7kLQsnJ7ZkK8Wf0r1r/assets/09.png)

Selecting the resource offers the ways in.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/Y8qwSnwjk5v50IYBqVOY/assets/10.png)

Select **Browser**. The session opens in a new tab with no client software needed, and the credential is injected by SECUREpass rather than shown to the user.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/iu9YEFiFKdJUgwHBWEoC/assets/11.png)

Recording starts the moment the session opens.
{% endstep %}

{% step %}

## Review the recording

Back in the admin console, open **Dashboard → User & Authentication**, scroll to **Sessions / Token Creations**, and expand it. On the **PAM** tab, **All Sessions** lists every privileged session with its recording.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/yTBqbWgWcxoElo9ik35r/assets/12.png)

Select the play icon to replay the session, or the download icon to keep a copy.

> Full detail: *Privileged Access → Session management and recording*.
> {% endstep %}
> {% endstepper %}

## Verify the setup

* [ ] The resource appears in Manage Systems with status **Active**.
* [ ] **Test Connection** succeeds.
* [ ] The account shows in the Account Vault with a rotation policy set.
* [ ] The user–resource mapping exists in Access Control and is active.
* [ ] The user can see the resource in their Self Service Portal.
* [ ] A test session opens, and its recording plays back from All Sessions.

## What comes next

Privileged identity management — who is privileged, what entitlements they hold, and how those are reviewed and certified — is a separate track from the connection setup above. See *Privileged Access → Privileged identity management*.

Five steps: onboard the resource, vault its credential, map the user, connect, and check the recording plays. If the last box ticks, the chain works end to end.